Project

Risk Assessment plan for Health Network Inc.

Date

20-09-2020

All organizations in the world face risk. Organizations are at the risk of their business not operating as they are meant; they are at the risk of natural disasters hampering their operations as well as the risk of losing their information due to cybercriminals or other incidences. Businesses and organizations must have risk management measures in place. The measures describe the risks likely to affect an organization as well as detail the actions or the measures in place to prevent the occurrence of both identified and unidentified risks. It is also critical that organizations and organizations have disaster recovery plans. The plans detail the steps to be taken by organizations in the case that risks become a reality. Considering the nature of operations at Health Network Inc., the organization must have a reliable risk Assessment Plan to ensure that it is safe from all possible incidences and also to ensure that its operations continue in case disasters or incidences happen.

Health Network Inc.

The organization is headquartered in Minneapolis, Minnesota. Also, the organization has branches in two other locations; Portland Oregon, and Arlington Virginia. The organization has over 550 employees. The organization makes over $450 million annual revenue. Each of the branches or locations of Health Networks Inc. is near a data center that is managed by a third-party vendor. Also, there are production centers located at the data centers. The three corporate data centers have over a thousand data servers, over 650 corporate laptops and other mobile devices

The organization has three main products. The first product is the HNeTExchange that facilitates the handling of secure electronic medical messages between small customers such as clinics and large customers such as hospitals. The second product is HNetPay which offers a web portal that supports secure payments. Also, the product supports various payment methods. The last product offered by the organization is HNetConnect, a product that allows customers to find doctors as it contains profiles of patients, doctors, and clinics.

The organization as well has an able information technology department that has the role of not only ensuring that all IT infrastructure attached to the organization is working as expected but they also maintain the security of all IT infrastructure owned by the organization. The department has installed several IT controls for its IT equipment and server rooms.

Just like all organizations, Health Network Inc.’s operations are dictated by the information, data that they have collected, the communication channels that they have, the infrastructure that they possess, and the human resource that they have. Any attack whether natural or man-made on the organization’s data centers, communication channel, buildings, employees, and infrastructure would negatively affect the organization and its operations.

Threats to the organization and its operations

There are six main threats to the organization and its operations. The first threat is the loss of the organization’s data due to the production systems being. The second threat is the loss of company information due to the loss of company-owned handheld devices, mobile devices, and laptops. The third threat is the loss of customers due to production outages. The fourth threat is a cyber threat due to company products being accessible on the internet. The fifth threat is insider threats and the last threat is possible changes in the regulatory landscape. To ensure that its operations continue in case any of their main areas are affected, the organization ought to have a risk assessment, mitigation, and disaster recovery plan.

The plan below details how the organization will further protect itself from incidences considering it has already good and reliable measures in place. The plan details the handling of incidences and their management. It also details, the personnel responsible for risk management, disaster management, and recovery. It also explains the actions to be carried to ensure operations continuity and recovery of infrastructure and resources.

The organization’s risk assessment plan exists for four main reasons. It exists first to identify the weaknesses of the organization and to implement a disaster prevention strategy or program. Secondly, it exists to minimize the duration of serious disruption to the organization’s operations. Thirdly, it exists to facilitate the effective coordination of the organization’s recovery tasks. Lastly, it exists to reduce and demystify the complexity of the organization’s recovery effort. The five phases of disaster recovery will act as the scope of the organization's risk assessment plan. The five phases are risk/disaster identification, mitigation, preparedness, response, and recovery.

Running head: RISK ASSESSMENT PLAN 1

RISK ASSESSMENT PLAN 11

Major Risk Assessment and Business Impact Analysis

Risk Assessment, Incident, and Disaster Recovery teams

For proper handling of risks and incidents, the organization should have incident and recovery teams. The incident command team should comprise at least a member of every unit or department in the organization. The command team will be headed by a risk manager who will be assisted by the affected unit’s head. The incident command team will report to the head of risk management. The incident command team will have two main duties. The team will be responsible for mitigating further damage due to an incident and it will also be responsible for assessing the damage that an incident or disaster has caused and will continue causing due to the ripple effect of an incident happening.